Vault holds the secret material for an environment: "Manage environment API secrets and vault entries." It covers three related things — API keys your backend uses to call Authdog, encrypted values your workloads read, and the encryption keys that wrap them.
Analytics
?tab=analytics — usage of the keys and secrets in this environment: which keys are being exercised, how often, and when each was last seen. A key with no recent activity is a candidate for revocation.
API Keys
?tab=api — "API access": "Create scoped environment secrets for backend access."
Click "Add new" to mint a key. Keys are scoped to the environment they were created in, so a dev key cannot read prod data. Empty environments read "No secrets yet."
Use these from server-side code to call the Authdog management and identity APIs. They are not for browsers — a public client uses the project and environment IDs from Overview instead.
Secrets
?tab=vault — "Store encrypted environment variables and secret values."
Add a named entry with "Add new"; the value is encrypted at rest with the environment's default KMS key. This is where third-party credentials belong — a Stripe secret key, an SMTP password, a provider client secret — rather than in your own configuration files.
KMS
?tab=kms — "Key management (KMS)": "Encryption keys for this environment. Secrets in the vault can be wrapped with a default key; decrypt and rotate using policies you attach to workloads."
The table shows Name, Algorithm, DEK stored, Status, and Created. "Add new" creates a key and designates how new secret material is encrypted for the environment.
The page states the rotation contract plainly: "Default keys apply to new encrypted secret material. Rotating a key marks the old material for re-wrap in the vault; plan a maintenance window before disabling a key that is still in use."
How the three fit together
- KMS defines the encryption keys.
- Secrets stores values wrapped by the default key.
- API Keys are the credentials your backend presents to read them.
Related
| Read | To learn how to |
|---|---|
| Console overview | Find the project and environment IDs for public clients |
| Authentication | Manage OpenID clients and their secrets |
| Sessions | Rotate the JWT signing keys, which are managed separately |
| Vault | Read and write secrets from application code |
| Backend requests | Authenticate server-to-server calls |